CVE-2026-13714

Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

CVE-2026-13714 — WPL Real Estate Unauthenticated RCE

Realtyna Organic IDX plugin + WPL Real Estate for WordPress < 5.3.0

Unauthenticated arbitrary file upload via hardcoded I/O API credentials, leading to remote code execution.

Vulnerability

The WPL Real Estate plugin ships a built-in I/O API (set_property) that is enabled by default and protected only by a pair of hardcoded keys (public_key / private_key). These keys are identical across every installation — they are embedded in the migration SQL that runs on activation.

The API accepts file uploads through the file[] multipart field with the prefix image_*, yet performs no validation on the uploaded file type. An unauthenticated attacker can upload arbitrary .php files, which are stored in a predictable path under wp-content/uploads/WPL/{pid}/, and execute them directly via HTTP.

No WordPress authentication, no nonce, no capability check — just the two hardcoded strings.

Attack Flow

Attacker                           Target (WordPress + WPL ≤ 5.2.0)
   │                                          │
   │  POST / (multipart/form-data)            │
   │  ├─ public_key  = <hardcoded>            │
   │  ├─ private_key = <hardcoded>            │
   │  ├─ cmd = set_property                   │
   │  └─ file[] = image_Nx_abc.php            │
   │─────────────────────────────────────────►│
   │                                          │ API validates keys ✓
   │                                          │ Saves file (no type check)
   │               {"success": true}          │
   │◄─────────────────────────────────────────│
   │                                          │
   │  GET /wp-content/uploads/WPL/{pid}/Nx_*  │
   │─────────────────────────────────────────►│
   │               PHP executed               │
   │◄─────────────────────────────────────────│

Script Features

Operating Modes

Output Files

Usage

python CVE-2026-13714.py

The script prompts for:

> Target list:    targets.txt
> Threads [1-50]: 10
> Mode [1/2/3]:   2

Target list format — one target per line:

example.com
https://site.com
http://192.168.1.10:8080
sub.domain.org/wordpress

Requirements

• Python 3.8+
• No external dependencies (stdlib only)

Remediation

• Update WPL Real Estate to version 5.3.0 or later
• If immediate update is not possible:
  • Rotate the I/O API keys in the database (wpl_settings table)
  • Disable the I/O API entirely if not in use
  • Block direct access to wp-content/uploads/WPL/ via server configuration

Disclaimer

This tool is provided strictly for authorized security testing and educational purposes. Use it only on systems you own or have explicit written permission to test.

Unauthorized access to computer systems is illegal under laws including but not limited to the Computer Fraud and Abuse Act (CFAA), the UK Computer Misuse Act, and equivalent legislation worldwide.

The author assumes no liability for misuse. By using this tool you accept full responsibility for your actions and agree to comply with all applicable laws and regulations.

Author

Nxploited — Khaled Alenazi

Telegram: @Kxploit

References

• NVD — CVE-2026-13714
• WPScan — WPL Real Estate
• CVSS 3.1 Base Score: 9.8 CRITICAL (CISA-ADP)